feat: path-based backend via Vercel rewrite

Replace subdomain (senzen-api.pantorn.site) with path-based routing:
browser hits senzen.pantorn.site/<path>, Vercel proxies the request
to Render at senzen-api.onrender.com/api/<path>.

- Add frontend/vercel.json: catch-all rewrite /:path* → Render /api/:path*
  (Vercel only applies rewrites when Next.js returns 404, so actual
  pages still work)
- vercel.tf: NEXT_PUBLIC_BACKEND = '' (empty) so the frontend builds
  relative URLs that resolve against the current origin
- cloudflare.tf: remove the senzen-api record (not needed anymore —
  the browser only ever sees senzen.pantorn.site)
- render.yaml: BACKEND_URL = https://senzen.pantorn.site (the URL
  the browser sees; Vercel rewrites /google_callback to
  Render /api/google_callback server-side)
- backend/main.go: move /health and /validate-token under /api/*
  so every backend route is consistently at /api/* (matches the
  rewrite destination pattern)
- outputs.tf: drop the backend_url and api_url outputs (no longer
  meaningful — the only public URL is the frontend)

What changes for the user:
- One DNS record instead of two
- No Cloudflare proxy needed (and no 'Full' SSL mode config)
- No CORS to configure (same origin)
- OAuth callback URLs become https://senzen.pantorn.site/{provider}_callback
- Cold-start caveat: Vercel free plan has 10s timeout; Render takes
  ~30-60s to wake from sleep. First request after 15 min idle fails
  with 504. Workaround: UptimeRobot pings /health every 14 min.

Author: Long104

backend/main.go

@@ -30,11 +30,13 @@ func main() {
 
 	app.Use(middleware.CORSMiddleware())
 
-	app.Get("/health", func(c *fiber.Ctx) error {
+	// All routes live under /api so the Vercel rewrite
+	// (/:path*  →  senzen-api.onrender.com/api/:path*) lines up.
+	api.Get("/health", func(c *fiber.Ctx) error {
 		return c.SendString("health check ok")
 	})
 
-	app.Get("/validate-token", middleware.ValidateToken)
+	api.Get("/validate-token", middleware.ValidateToken)
 
 	routes.SetupOAuthRoutes(api)
 	routes.SetupAuthRoutes(api)

frontend/vercel.json

@@ -0,0 +1,8 @@
+{
+  "rewrites": [
+    {
+      "source": "/:path*",
+      "destination": "https://senzen-api.onrender.com/api/:path*"
+    }
+  ]
+}

infra/terraform/cloudflare.tf

@@ -1,49 +1,21 @@
 # =============================================================
-# Cloudflare DNS — senzen.pantorn.site
+# Cloudflare DNS — pantorn.site
 # =============================================================
-# This file manages the DNS records for the Senzen project.
-# Records:
-#   senzen         CNAME → cname.vercel-dns.com          (frontend,  DNS-only)
-#   senzen-api     CNAME → <render-service>.onrender.com (backend,   Cloudflare-proxied)
+# Path-based architecture: the frontend (senzen.pantorn.site) is
+# on Vercel, and Vercel rewrites /<anything> to Render's
+# /api/<anything> via vercel.json. The browser only ever sees
+# senzen.pantorn.site, so only ONE DNS record is needed:
+#   senzen  CNAME → cname.vercel-dns.com  (frontend, DNS-only)
 #
-# The backend is proxied (orange cloud) because Render's free
-# plan does NOT support custom domains — so the service runs
-# at senzen-api.onrender.com, and Cloudflare terminates TLS
-# for senzen-api.pantorn.site using Universal SSL, then
-# forwards to Render in "Full" SSL mode (no cert verification).
-#
-# Both records are ONE level deep under pantorn.site so they're
-# covered by Cloudflare's Universal SSL (*.pantorn.site).
+# No backend DNS record — the backend is reached via the Vercel
+# rewrite, never directly via a public hostname.
 # =============================================================
 
-# ─────────────────────────────────────────────────────────────
-# Frontend: senzen.pantorn.site → Vercel (DNS-only)
-# Vercel issues its own Let's Encrypt cert via ACME HTTP-01,
-# which fails if Cloudflare proxy is on. So we leave it
-# proxied = false and let Vercel handle TLS.
-# ─────────────────────────────────────────────────────────────
 resource "cloudflare_record" "senzen_frontend" {
   zone_id = var.cloudflare_zone_id
-  name    = split(".", var.frontend_domain)[0] # "senzen" from "senzen.pantorn.site"
+  name    = split(".", var.frontend_domain)[0] # "senzen"
   type    = "CNAME"
   value   = var.vercel_cname_target
   proxied = false
-  comment = "Senzen frontend → Vercel (DNS-only, Vercel issues cert)"
-}
-
-# ─────────────────────────────────────────────────────────────
-# Backend: senzen-api.pantorn.site → Render (proxied)
-# Render free plan doesn't issue certs for custom domains.
-# Cloudflare proxies, terminates TLS with Universal SSL, and
-# forwards to Render's onrender.com URL. Set Cloudflare zone
-# SSL mode to "Full" (NOT "Full (Strict)") so the origin cert
-# isn't required to be valid for senzen-api.pantorn.site.
-# ─────────────────────────────────────────────────────────────
-resource "cloudflare_record" "senzen_backend" {
-  zone_id = var.cloudflare_zone_id
-  name    = var.backend_subdomain # "senzen-api"
-  type    = "CNAME"
-  value   = "${var.render_service_name}.onrender.com"
-  proxied = true
-  comment = "Senzen backend → Render via Cloudflare proxy (Render free doesn't support custom domains)"
+  comment = "Senzen frontend → Vercel (DNS-only, Vercel issues its own cert)"
 }

infra/terraform/outputs.tf

@@ -9,31 +9,16 @@ output "vercel_project_id" {
 }
 
 output "frontend_url" {
-  description = "Public frontend URL (custom domain)"
+  description = "Public frontend URL (custom domain) — also the only public URL for the backend (Vercel rewrites /<path> to Render /api/<path>)"
   value       = "https://${var.frontend_domain}"
 }
 
-output "backend_url" {
-  description = "Public backend URL (custom domain + /api prefix)"
-  value       = "https://${var.backend_subdomain}.${var.frontend_domain}"
-}
-
-output "backend_api_url" {
-  description = "Backend API base path the frontend calls"
-  value       = "https://${var.backend_subdomain}.${var.frontend_domain}/api"
-}
-
 output "render_onrender_url" {
-  description = "Render's default onrender.com URL (DNS target in Cloudflare)"
+  description = "Render's default onrender.com URL — backend is reached through this only via the Vercel rewrite, not directly"
   value       = "https://${var.render_service_name}.onrender.com"
 }
 
 output "cloudflare_record_senzen" {
   description = "Cloudflare CNAME record for the frontend"
   value       = cloudflare_record.senzen_frontend.hostname
 }
-
-output "cloudflare_record_api" {
-  description = "Cloudflare CNAME record for the backend"
-  value       = cloudflare_record.senzen_backend.hostname
-}

infra/terraform/vercel.tf

@@ -27,7 +27,9 @@ resource "vercel_project_environment_variable" "frontend_url" {
 resource "vercel_project_environment_variable" "backend_url" {
   project_id = vercel_project.cashwise.id
   key        = "NEXT_PUBLIC_BACKEND"
-  value      = "https://${var.backend_subdomain}.${var.frontend_domain}/api"
-  target     = ["production"]
-  sensitive  = false
+  # Empty string so the frontend builds relative URLs like "/api/users"
+  # which Vercel rewrites to https://senzen-api.onrender.com/api/users
+  value     = ""
+  target    = ["production"]
+  sensitive = false
 }

render.yaml

@@ -46,7 +46,10 @@ services:
       - key: FRONTEND_URL
         value: https://senzen.pantorn.site
       - key: BACKEND_URL
-        value: https://senzen-api.pantorn.site
+        # Public URL the user sees — used by OAuth providers as the
+        # callback redirect base. Vercel rewrites /google_callback to
+        # Render's /api/google_callback server-side.
+        value: https://senzen.pantorn.site
       - key: GO_ENV
         value: production